North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack
Essential information
- Published
- 01/04/2026 15:28
- Modified
- 01/04/2026 19:29
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- axios javascript npm
- Tags
- 2026-04-01 axios javascript npm
- Related entities
- 8 indicators, 8 observables, 1 intrusion sets (apt), 5 techniques (mitre), 1 others
Description
Google Threat Intelligence Group (GTIG) is tracking an active software supply chain attack targeting the popular Node Package Manager (NPM) package "axios." Between March 31, 2026, 00:21 and 03:20 UTC, an attacker introduced a malicious dependency named "plain-crypto-js" into axios NPM releases versions 1.14.1 and 0.30.4. Axios is the most popular JavaScript library used to simplify HTTP requests, and these packages typically have over 100 million and 83 million weekly downloads, respectively. This malicious dependency is an obfuscated dropper that deploys the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.